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METHOD AND SAFETY SYSTEM FOR A DISPLACEMENT DEVICE OF A MOTOR 
VEHICLE 

5 

PREVIOUSLY AMENDED CROSS-REFERENCE TO RELATED APPLICATION ( S } 

This application is a National Phase Patent Application 
of International Application Number PCT/DE2003/002 690, filed 
on August 6, 2003 , which claims priority of German Patent 
10 Application Number 102 36 106.1, filed on August 7, 2002 . 

BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

15 The invention relates to a method and a safety system for 

a locking device for a motor vehicle . 

2 . Prior Art 

From the prior art it is known to use serial data 
20 protocols of a bus technology in the motor vehicle for data 
transfer between electronically controlled devices . Thus by 
way of example the individual body control devices are linked, 
such as the central body electronics, combination instruments 
and control devices in the doors . From the central body 
25 electronics, a central control device in the motor vehicle, 
trigger signals are generated more particularly for the 
central locking function and are transferred to the executing 
control devices by means of a serial data protocol . The 
locking function is thereby dependent on these trigger 
30 signals . 

Furthermore it is known in the event of a complete 
breakdown of the bus system to switch the door control devices 
over automatically into an emergency operating mode in order 
to enable the functions pertaining to safety which are 
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dependent on being triggered. It has however been seen that 
even with a breakdown of one part of the electronics which are 

5 connected through the bus (central control device or further 

instruments of the motor vehicle connected thereto) important 
or even all functions of the displacement systems can be 
blocked because a failed electronics unit could no longer 
supply the data which was necessary to generate the trigger 

10 signals . Such emergency operating modes for window lifters 
are known for example from EP 1 060 922 A or DE 199 28 101 C2 . 

Furthermore the technical functioning of the displacement 
systems is dependent on the functional ability and reliability 
of the control devices . Breakdown situations which lead to a 

15 partial failure of the control electronics run the risk of 
generating parasitic resistances which clearly reduce 
insulation between two conductor paths of the electronics of 
the door control device. Parasitic resistances caused in this 
way can have values of some hundred ohms . If this resistance 

20 arises between a control connection of a power switch and a 
fixed potential, more particularly the battery voltage or the 
earth connection, then this can lead to undesired control of 
the power switch and consequently to an undesired adjustment 
of the displacement device . 

25 The breakdown of parts of the vehicle electronics, more 

particularly the bus system or the control device through 
crash effects can lead to the undesired displacement of the 
displacement device in the emergency accident situation and to 
additional dangers . 

30 

SUMMARY OF THE INVENTION 

The object of the invention is to provide a method and 
system for safeguarding a locking device of a motor vehicle 
which enables the opening of the locking device in the event 
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of a breakdown of parts of the system, and at the same time 
reduces the risk of automatic responses in a non-desired state 

5 or manual faulty functions . 

According to this object, a safety system is provided for 
a locking device of a motor vehicle, the safety system 
comprising a control device which has at least one power 
switch for actuating an electromechanical unit into the 

10 [ [«] ] blocking [[*] ] state, also termed [ [ » ] ] safe [ [ " ] ] 
state [ [ , ] ] and which can additionally be controlled through a 
central control device. This blocking state differs from the 
locking states "unlocked" and "locked" of the locking device 
of the vehicle door. 

IS If the electromechanical unit is in the 

[ ["] ] unlocked [ ["] ] state the motor vehicle door can be opened 
manually both from outside and from inside the vehicle. In 
addition, the motor vehicle door can be opened automatically 
by means of a motorized central locking system. 

2 0 In the [ ["] ] locked [ ["] ] state the motor vehicle door can 

no longer be opened from the outside of the vehicle, but still 
all mechanical functions of the electromechanical unit are 
activated, so that the motor vehicle door can be opened from 
inside of the vehicle . The opening may also still be possible 
2 5 from the outside by an extra aid using a predefined tool, in 
case the vehicle user has accidentally been locked out of the 
vehicle . 

In order to prevent theft of the vehicle, the 
electromechanical units of the motor vehicle can be moved into 
30 the [ [«] ] blocking [ ["] ] state. In the [ [»] ] blocking [ ["] ] state 
all mechanical functions of the electromechanical unit are 
deactivated, so that the vehicle door cannot be opened using 
the predefined tool or manually from the inside of the 
vehicle . 
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These different states are caused through the 
electromechanical unit which produces at least the states 

5 [ [»] ] unlocked [ ["] ] [ ["] ] locked [ ["] ] and [ [«] ] blocking [[" ] ] 

through the supply of electrical energy by means of mechanical 
adjustments . The states described can in principle be 
different for the relevant vehicle doors or also a trunk door 
of the motor vehicle . 

10 The states of all the locking units of one vehicle are 

preferably tuned with each other through the central control 
device by means of serial data protocols . 

For this a central control device is provided which has 
signal links, more particularly a serial bus connection to the 

15 control devices of the relevant door of the motor vehicle. 
These signal links enable data transfer to produce the desired 
states in that the electromechanical unit can be controlled 
through the central control device via the signal links . By- 
way of example the signal links enable a data transfer to 

20 transmit the desired states from the central control device to 
the relevant control devices for controlling the local locking 
device . 

Data transfer is constituted in a simple case by a 
signal, a voltage or binary data being indicative of the 

25 relevant situation. More complex links enable an improvement 
in the reliability of the transfer and the transfer of 
commands , status data and/ or diagnosis data of the 
electromechanical unit or from operating elements . 

In order to provide a secure system, the door control 

30 device is connected to the central control device through an 
electrical lead connection which is independent of the signal 
links . For the lead connection to be independent from the 
signal links, it is necessary that the voltages or signals 
transferred via the signal links do not influence the 
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independent electrical lead connection. A particularly- 

expedient simple design of the invention proposes that a 
5 separate conductor which is electrically insulated from the 

signal links is used as the independent electrical lead 
connection. 

A potential of a control connection of the previously 
mentioned power switch can be controlled by the central 

10 control device through this independent electrical lead 
connection for energizing the electromechanical unit or a 
power connection of the control device which can be connected 
to the electromechanical unit . The control is preferably 
undertaken directly by connecting the control connection or 

15 power connection electrically and directly to the central 
control device through the independent electrical lead 
connection. Alternatively the potential of the relevant 
connection could also be controlled indirectly by the central 
control device by switching a further logic element, by way of 

20 example a switch transistor in between the independent 
electrical lead and the relevant connection. 

Consequently the actuation is carried out with an 
additional enabling control being provided via the independent 
electrical lead connection by the central control unit to the 

25 relevant local control devices, wherein without this enabling 
an actuation of the electromechanical unit into the 
[ ["] ] blocking [ ["] ] state is not possible. 

According to a further advantageous embodiment of the 
invention the central control device only enables the 

30 actuation of the electromagnetic unit into the 
[ ["] ] blocking [ ["] ] direction when the functional capacity of 
the serial data transfer is ensured through the signal link, 
which can happen for example through a continuous status 
enquiry of all the control devices and central control devices 
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involved. For this the central control device has 

advantageous ly an evaluation device which is designed for 

5 controlling the power connection in dependence on a state or 

an emergency operation of the signal links . This evaluation 
device interrogates cyclically for example the junctions of a 
bus system of the signal links in order to check their 
functional ability and the functional ability of the signal 

10 links . More advantageously, additional vehicle states are 
evaluated, more particularly the ignition state . A switched- 
off ignition is thereby a further condition for controlling 
the potential of the control connection. If at least one 
condition is not fulfilled, for example the failure of the 

15 serial data protocol as a result of physical actions in the 
event of a crash, the enabling condition is not fulfilled, 
i.e. this is set back so that the potential to the 
independent electrical lead connection is not controlled 
through the central control device. 

20 An advantageous development of the invention proposes 

that for control the potential can be switched to this 
independent electrical lead connection. Preferably the output 
of the central control device has for this switch process a 
low-resistance output which clearly reduces the tendency of 

25 this independent electrical lead connection to react 
sensitively to breakdown factors . A low-resistance output of 
this kind is achieved for example by using switch transistors 
which have in addition to the connection to the independent 
electrical lead connection a further connection to a current 

30 or voltage source, by way of example to a battery voltage or 
to earth. 

As a result of the low output resistance parasitic 
resistances which may appear in accident situations only have 
a slight influence on this potential bearing on the 
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independent electrical lead connection. Furthermore in 

. another embodiment of the invention the switching of the 

5 battery voltage or earth connection provides the possibility 

of transferring through this independent electrical lead 
connection the drive energy for the electromechanical unit at 
least for an adjusting direction. 

In a further development of the invention the central 

10 control unit has at least one switch for switching at least 
two different potentials . These potentials are by way of 
example the said earth potential or the battery voltage 
potential . If on the other hand a digital evaluation of the 
potential is preferred then a logic level, for example a level 

15 of 5 volt can also be used as one of the two different 
potentials . By way of switching over the two potentials it 
avoids that in one time state a high— resistance output of the 
central control device leads to an undefined potential at the 
independent electrical lead connection. 

20 In order to further increase the security of this safety 

system, in a particularly advantageous development of the 
invention for controlling the [["] 3 blocking [["] ] state the 
control of the potential through the central control device 
and a control through the logic of the control device are 

25 logically AND- linked. The logic of the door control device is 
thereby for example a micro controller integrated in the door 
control device which can in turn be connected through one of 
the signal links to the central control device. Through this 
logic AND- link a safety redundancy is generated which further 

30 reduces the influence of parasitic resistances . Furthermore 
it can be checked when checking the input states of the logic 
AND- link whether the control device of the door and the 
central control device are in the normal operating mode. 

An advantageous development of this design of the 
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invention proposes that for the logic AND- link the switch of 
the central control device and a switch of the logic of the 

5 door control device form a series connection. The switches 

are preferably mechanical switches, more particularly switch 
transistors which in turn have a control connection. A first 
sub-variation of this development of the invention proposes 
that both switches are connected together electrically 

10 directly. Alternatively this second sub variation of this 
development proposes that both switches are connected together 
through a further element more particularly through at least 
one connection of the power switch or power connection of the 
door control device. The potential for controlling the power 

15 switch is preferably switchable between the earth potential 
and a control potential which can be less than or equal to the 
battery potential . 

In order to achieve a further increase in the safety of 
this safety system in a further advantageous development of 

2 0 the invention in each local control device for controlling the 

electromechanical unit a preferably permanent plausibility 
check takes place in which the potential of the independent 
electrical lead connection is only then applied if the 
conditions "ignition off" and "undisturbed signal connections" 
25 are met . 

A preferred embodiment of the invention proposes that the 
connections are a constituent part of a bus system. This bus 
system is preferably a CAN- bus system which enables a link 
with the central control device and further devices of the 
30 motor vehicle. If at least a bi-directional link, for example 
that of a CAN- bus , is used then a transfer of status data is 
possible between the devices of the motor vehicle. In 
addition to the status data, further information on an 
operating mode, for example an emergency operation during an 
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accident situation or a defect in the devices and a normal 
operating mode, can be transferred. Further developments of 

5 this embodiment additionally permit a transfer of diagnostic 

data through the CAN-bus system which register the updated 
reliability of individual elements of the safety system, more 
particularly the reliability of the potentials and the 
independent electrical lead connection to the central control 

10 device. 

A particularly advantageous development of the invention 
proposes that the control device has a micro controller. A 
constituent part of this micro controller is for example a 
logic which enables the logical AND- link to the control of the 

15 central device. Furthermore this micro controller serves to 
control and evaluate further operations of the function 
elements of the motor vehicle door. This micro controller is 
furthermore connected for control to the power switch through 
its control connection. For this an output PIN of the micro 

20 controller can be connected directly to a discrete power 
switch in the form of a power transistor or a relay. 
Alternatively an indirect switching is also possible through a 
further logic of the control device of the door or through a 
logic of the central control device. For controlling the 

25 relay the connection can advantageously be through a driver 
transistor for energizing the relay coil . As an alternative 
to the connection through lead elements of a plate it is 
possible to integrate the micro controller together with the 
power switch on a semiconductor chip as so-called smart power 

30 technology. 

In a further advantageous development of the invention it 
is proposed that the micro controller of the control device is 
in active connection with the independent electrical lead 
connection for evaluation. This active connection enables the 
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detection of states and faulty functions of the lead 
connection or signals or potentials being transferred. These 

5 faulty functions can be evaluated by the control device or 

alternatively in an advantageous development of this form of 
the invention it is proposed that the micro controller of the 
control device transfers through one of the signal links a 
status of the potential of the control connection of the lead 

10 switch or the state of the electromechanical unit to the 
central control device. In this case an evaluation of the 
detected states and functional abilities through the central 
control device is possible in that this evaluates all time 
changes detected by the control device and registers by means 

15 of a plausibility check any deviation from a normal operation 
and where applicable starts an emergency operation. In this 
emergency operation mode a release is now consequently changed 
by way of example to actuate the electromechanical unit into 
the [ [ " ] ] blocking [ [ " ] 3 direction. 

20 In a further advantageous development of the invention a 

window lifter drive of the motor vehicle door can be enabled 
to be actuated in the [ ["] ] closing [ ["] ] direction through the 
independent electrical lead connection. By controlling the 
window lifter via the electrical lead connection, it can be 

2 5 prevented that an automatic closing operation of the window 
lifter is disabled in an emergency operating situation. If a 
critical state of the electromechanical unit is already 
reached and an unlocking is no longer possible, in an 
emergency operating case the window lifter drive is controlled 

30 so that automatic opening of the window pane for this 
emergency operation is possible. 

One method for securing this adjusting device of a motor 
vehicle can be used with particular advantage . For this for 
example it is possible to use the safety system previously 
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outlined or a modified safety system. Advantageous ly for 
controlling a lock of the vehicle in the [ ["] ] blocking [ ["] ] 

5 (safe) state in a first method step the functional reliability 

of a central control device and its connections are evaluated. 
In order to determine the operating state of the vehicle a 
characteristic value is evaluated. This characteristic value 
is for example the switched state of the ignition of the 

10 vehicle, so that [ [ " ] ] blocking [ [ " ] ] of the vehicle is not to 
take place when the ignition is switched on. 

If the operating state of the vehicle for a 
[ [ " ] ] blocking [ [ " ] ] through the lock represents no danger for 
the occupants of the vehicle then a potential for controlling 

15 the lock is switched to an electrical lead connection which is 
independent of the signal links . A control command is 
transferred through one of the signal links of the central 
control device to a control device . If through the evaluation 
a fault- free functioning of the devices and the signal link is 

20 detected, then an electromechanical unit of the lock is 
energized through a power switch of the control device of the 
door and the lock is switched to the [ ["] ] blocking [ [" ] ] state. 

BRIEF DESCRIPTION OF THE DRAWINGS 

2 5 The invention will now be explained in further detail 

with reference to embodiments illustrated diagrammatically in 
the drawings : 

Figure 1 shows 

30 

Figure 2 shows 
Figure 3 shows 
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Figures 4a and 4b show a flow chart of a safety process . 

5 DETAILED DESCRIPTION OF THE DRAWINGS 

Figure 1 shows diagrammatically a motor vehicle. For 
communication this motor vehicle has a central control device 
ZSG which can be controlled optically or by radio by means of 

10 a remote control RC, by way of example by a vehicle key. This 
central control device ZSG is connected through a bus system 
CAN to door control devices TSG 1 , TSG 2 , TSG 3 and TSG 4 . 
The door control devices TSG 1, TSG 2, TSG 3 and TSG 4 are 
disposed in the four doors of the motor vehicle . Connections 

15 of the bus communications structure CAN are laid in the 
vehicle doors from inside the vehicle through door partitions 
TSS 1, TSS 2, TSS 3 and TSS 4 and are there connected to the 
door control devices TSG 1 , TSG 2 , TSG 3 and TSG 4 . 

A block circuit diagram of the safety system is 

20 illustrated in Figure 2. Figure 2 shows by way of example a 
door control device TSG which is connected through an 
interface TSS to the central control device ZSG as well as a 
battery of the vehicle Bat. An analogous structure is also 
produced for the other door control devices of the motor 

25 vehicle. The battery Bat has two connections B and GND for a 
battery voltage potential Ub and the earth connection GND. 
Both connections are connected both to the central control 
device ZSG and to the door control device TSG. The central 
control device ZSG has a micro controller |iCl and a CAN- bus 

30 interface CAN. The CAN-bus interface CAN is connected through 
the CAN-bus CAN through the door partition TSS to a CAN-bus 
interface CAN of the door control device TSG. A further 
connection, St, control lead is independent of the CAN-bus and 
exists between the central control device ZSG and the door 

35 



-12- 



REPLACEMENT SPECIFICATION CLEAN VERSION 

1 54186/MEG/M521 

control device TSG. For controlling the potential of the 
independent electrical control lead St the central control 

5 device ZSG has two potential switches PS1 and PS2 whereby the 

first potential switch (control switch) PS1 is connected to 
the battery voltage potential Ub and to the control lead St. 
The second potential switch (control switch) PS2 is however 
connected to the control lead St and to earth GND. 

10 The door control device TSG is apart from the link to the 

central control device ZSG through the CAN- bus system CAN and 
the independent electrical control lead St, as well as from 
the supply lead to the motor vehicle battery Bat, also 
connected to further function units of the vehicle door . Two 

IS electromechanical adjusting drives Ml and M2 are connected to 
the door control device TSG which has power switches LSI and 
LS2 for energizing the two drives Ml and M2 . The first 
adjusting drive Ml is an adjusting drive of a vehicle lock 
wherein this adjusting drive Ml serves to lock and unlock the 

2 0 vehicle door. The second electromechanical drive M2 serves to 

switch the same lock into the [ [ " ] ] blocking [ [ " ] ] state, thus a 
so-called safe state . 

In order to actuate the second adjusting drive M2 by 
means of the second power switch LS2 , the second power switch 

25 LS2 is connected by means of the control lead St to the 
central control device ZSG. The second power switch LS2 as 
well as the first power switch LSI are constituted by 
mechanical power switches in the form of relays or are 
constituted by full- or semi -bridged semiconductors . The 

30 power switches LSI and LS2 have for this several control 
inputs (not shown in Figure 2 ) . These control inputs are 
connected to the micro controller uC2 of the door control 
device TSG and control lead St or further input wiring. 

In order to move the lock into the [ [ " ] ] blocking [ [ " ] ] 
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state it is first checked whether the safety system is in the 
normal operating mode. The central control device ZSG then 

5 switches the control lead St by means of the potential switch 

PS1 to the operating voltage potential Ub of the battery Bat. 
For this the second potential switch PS2 which has connected 
the control lead St previously to the earth is opened . At the 
next stage the central control device ZSG sends via the CAN- 

10 bus CAN a signal into the door control device TSG which 
contains a command to energize the second electromechanical 
drive unit M2 . 

The circuit plan illustrated in Figure 3 shows a section 
of the more specific design of the embodiment shown in Figure 
15 2 . In Figure 3 connections from the central control device 
ZSG to the door control device TSG are shown , the connections 
being constituted by the control lead St the battery 
connection Ub as well as the earth connection GND. The CAN- 
bus system CAN is in turn provided for communication between 

2 0 the door control device TSG and the central control device 

ZSG. The door control device TSG is in turn connected to a 
lock Sch of a vehicle door through three current leads . The 
lock Sch of the vehicle door is mounted in a wet space N of 
the vehicle door on one side of a wet /dry separation NT and is 

25 suitably sealed against the penetration of damp . 

On the other side of the wet /dry separation NT the door 
control device TSG is mounted on the dry space side T of the 
vehicle door and has no adequate damp protection from the wet 
space N. For communication between the door control device 

30 TSG and the central control device ZSG through the CAN-bus CAN 
the micro controller uCl of the central control device ZSG and 
the micro controller uC2 of the door control device TSG are 
connected together through transceiver circuits Trans 1 and 
Trans 2 which provide suitable hardware for the CAN-bus 
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control . Additionally the micro controller jjtCl of the central 
control device ZSG is connected with a control connection with 

5 a field effect transistor JFET which enables the battery 

voltage Ub to be switched to the control lead St. 

The micro controller \.iC2 of the door control device TSG 
has three outputs which are each connected through resistances 
Rl, R2 or R3 to driver transistors, in this case NPN bipolar 

10 transistors Ql, Q2 and Q3 . The driver transistors Ql, Q2 and 
Q3 are each connected to a relay coil Inl, In2 and In3 of a 
relay Rll, R12 and R13 respectively, the driver transistors 
Ql, Q2 and Q3 thereby switch the connections of the relay 
coils Inl, In2 , In3 to earth. The other relevant connection 

15 of the relay coils Inl and In2 is connected to the battery 
voltage Ub, whilst the relay coil In3 is connected to the 
second connection to the control lead St. This third relay 
R13 serves to energize the second electromechanical drive unit. 
M2 of the lock Sch in the direction of the blocking state 

20 "Safe". 

In order to switch the lock into the blocking state the 
control St lead must consequently be switched by the field 
effect transistor JFET of the central control device ZSG to 
battery voltage potential Ub and at the same time the driver 

25 transistor Q3 has to be switched through the micro controller 
JJ.C2 of the door control device TSG via the third resistance 
R3 . Consequently in order to operate the lock in the 
[ ["] ] blocking [ ["] ] state, the driver transistor Q3 and field 
effect transistor JFET of the central control device ZSG must 

30 both be conducting, thus fulfilling a logical AND-condition . 

The relay switches SI, S2 and S3 are provided for the 
actual energizing of the drive units Ml and M2 of the lock 
Sch. These relay switches are connected on the one hand to 
earth GND and on the other to the battery voltage Ub. The 
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relay switch S3 of the third relay R13 can be connected 
selectively to the battery voltage Ub or to the control lead 

5 St through a so-called jumper or bridge Jp. If the relay 

switch S3 is additionally connected to' the control lead St 
then the second drive unit M2 of the lock Sch is energized 
through the control lead St . 

Instead of the relays Rll, R.12 and R13 illustrated in 

10 Figure 3 it is also possible to use as an alternative power 
semiconductors which can also be integrated in the micro 
controller \iC2 as smart power elements . If the semiconductor 
power switches are formed as discrete elements then their 
control is preferably counter-phased, in order to obtain with 

15 the appearance of a parasitic resistance a same-phased 
breakdown voltage on the control connections of the discrete 
power switches which does not cause any undesired switching 
through of the power transistors . This is particularly the 
case since the parasitic resistances act the same on parallel 

2 0 mounted conductor paths which serve to control these discrete 

power switches . 

Figures 4a and 4b show a procedure for securing a motor 
vehicle lock diagrammatically by means of a flow chart. In a 
first step the central control device ZSG receives the command 

25 "safe" , thus to move the motor vehicle doors into the 
[ [ w ] ] blocking [ ["] ] state. This can be carried out by way of 
example through a remote control or the actuation of one of 
the locks by means of a vehicle key. In a second step it is 
checked whether the connections of the CAN-bus system function 

30 fault-free. For this the central control device ZSG can check 
for example at least the door control devices TSG of the motor 
vehicle doors for functioning ability. If functioning ability 
of the CAN- bus connection is provided then in a third step 
the interrogation of a CAN value of the motor vehicle is 
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carried out in this embodiment according to the state of the 
engine ignition. 

5 If in this third step the engine ignition is switched on 

through the ignition key, in a fourth step in Figure 4a the 
potential is applied to an independent electrical lead 
connection St . Then in a fifth step a safe control command is 
sent to the door control devices TSG from the central control 

10 device ZSG via the bus system CAN. If in the second step a 
fault has appeared in the CAN bus communication or if the 
engine ignition is inactive, in a sixth step a fault is 
indicated through the safety system. Then in a seventh step 
the fault is protocolled in a file and made available for a 

15 later fault diagnosis . 

Figure 4b shows the second part of the safety method 
through the safety system which proceeds in the door control 
device TSG. After the fifth step of Figure 4a , the transfer 
of the safe control command through the CAN-bus to the door 

20 control device TSG, the control potential of the control lead 
St is checked in the door control device TSG through its micro 
controller uCl . If the control potential corresponds to the 
potential for blocking the vehicle door, then in a ninth step 
a plausibility check of the overall system takes place in 

2 5 which for example the communications system as well as the 

functional ability of the door control device TSG is checked. 

If the plausibility check also produces a positive result 
then in the tenth method step the lock Sch is controlled into 
the blocking state. If in step eight the control potential is 
30 unsuitable for controlling the second electromechanical unit 
M2 in the blocking direction, then in step eleven a 
notification is displayed that the overall locking system, for 
example a central locking system ZV, is in a defect state. 
Similarly in the eleventh step the display of a defect in the 
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central locking system ZV takes place if the plausibility 
check of the ninth method step produces a negative result. In 

5 this case in addition to the display in the method step eleven 

the lock is controlled in a twelfth step in the unlocking 
direction in order to be able to ensure that any person who 
may be in the vehicle can leave the vehicle if the lock was 
not able to pass into the blocking (safe) state. 

10 Accordingly the detection of a fault triggers a display 

of a critical state in a vehicle display for the vehicle user 
and the door locks are controlled into the [ [ "unlocked" ] ] 
state. An end position in the [["safe"]] region is 

consequently possible through the lock mechanism only via the 

15 intermediate position [ [ " ] ] locked [ [ " ] ] so that in the event of 
a fault two conditions have to be met in order to bring the 
vehicle door from the [ [ " ] ] unlocked [ [ " ] ] state into the 
[ [ " ] ] locked [ ["] ] state. 

2 0 
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